Contact Form 7 Honeypot

Contact Form 7 Honeypot is a simple spam protection plugin for Contact Form 7. It is easy to add and protects forms from spambots. All this without annoying captchas or loading external JavaScript through Google’s reCAPTCHA.

Ever since we started working with WordPress, we have used Contact Form 7 to build forms. The plugin has always served us well.

Spam protection for WordPress forms

Over the years, however, anti-spam measures have changed. In the beginning, Contact Form 7 had no spam protection of its own, but there were many add-ons such as Really Simple CAPTCHA to keep Contact Form 7 free of spam.

From a usability and accessibility point of view, the original captchas were not user-friendly. Most of the time you could hardly make out the strings of letters, as distorted text and background patterns made them almost unreadable.

It was only Google’s reCAPTCHA v2 that provided a remedy. In most cases, all you had to do was tick a checkbox with a single click, which was already a problem for bots. Later, with Invisible reCAPTCHA, the CAPTCHA disappeared into the background entirely.

reCAPTCHA was integrated into Contact Form 7 with version 4.3, so that no additional plugins were needed. Thanks to the convenient implementation and improved usability, it was used for spam protection for a long time.

Google reCAPTCHA and data protection

The GDPR (General Data Protection Regulation) has brought data protection back into focus. As Google’s reCAPTCHA loads JavaScript from Google servers and receives visitors’ IP addresses in the process, we switched to an alternative solution.

Contact Form 7 Honeypot

A simple plugin for anti-spam functionality is Contact Form 7 Honeypot. The add-on is easy to download and is active on more than 200,000 sites.

It was important to us to find a good alternative to reCAPTCHA. Anything else would have been a step backwards in terms of usability. At the same time, the spam protection has to work reliably.

How the honeypot works

That is why a honeypot sounded like the perfect solution. WordPress has written a very nice explanation of how it works:

“The principle of a honeypot is simple: bots are stupid. While some spam is hand-crafted, the vast majority comes from bots written in a specific (large-scale) way to submit spam through most known form types. In doing so, they blindly fill in fields, regardless of whether they are required or not. This is how a honeypot catches the bot: it introduces an additional field that invalidates the form if it is filled in.”

Source: WordPress.org

Configuring WordPress spam protection for Contact Form 7

The plugin is very easy to use.

After installation, a new button is available for creating a honeypot field. In the front end, the field is hidden with CSS. Spambots fill in the field by mistake, fall into the trap and the submission is rejected.

When generating the honeypot field, it is recommended to use a name other than the default “honeypot” to make life harder for bots. A typical label such as email, first name or website is better. It is also recommended to add two honeypot fields to make it even harder for the bots.

How reliable is the plugin?

Contact Form 7 Honeypot essentially works only with hidden fields. The plugin therefore doesn’t even promise to stop all spam. Against very sophisticated bots, Google’s reCAPTCHA will offer even better protection.

Spambots are constantly being adapted, so the plugin will probably stop working at some point. Until then, it is a very good alternative to captchas.

(Image source: 123rf by surfupvector)